The vulnerability in rsync before version 3.5.0 arises because the daemon changes directory (chdir) to the module root at session initialization without resolving symbolic links using realpath() or an equivalent method. When use chroot is disabled and the module root or one of its components is a symlink, subsequent relative path operations reference files relative to the symlink target rather than the intended module root. This improper link resolution (CWE-59) enables unauthorized remote clients to traverse directories and access files outside the designated module root.

Remote clients can exploit this vulnerability to access files outside the intended module root directory on the rsync server when use chroot is disabled and symlinks are present in the module root path. This unauthorized file access can lead to disclosure of sensitive information.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should consider enabling use chroot or avoid using symlinks in the module root path to mitigate the risk.